Hello team, Our team just started to use Pulumi Service and we have an organization. Is there a way to generate access token on behalf of that organization? I can only generate my individual personal access token. If there is a way, do I need to be an admin of that organization?

You do need to be an admin to create an org token, per: https://www.pulumi.com/docs/intro/pulumi-service/organization-access-tokens/

Thank you for confirming @stocky-restaurant-98004 🙏

Docs say "Organization tokens are available on trials, and Enterprise and Business Critical subscriptions." We are on a trial but will eventually be on Team pricing, not Enterprise or Business Critical at this time.

You can use a non-shared CI account.

@stocky-restaurant-98004 Can you confirm Org Tokens are not available on Team accounts after the trial ends?

@crooked-notebook-49997 That's correct - they will no longer be available once the trial ends.

So what would be the recommendation in that case for configuring access without personal tokens?

@crooked-notebook-49997 I think it's what you meant when you said "a workaround like a shared account". Just, don't share it. There's no need for anyone to use it once it's created and set up in CI. The creds remain in a vault and no one ever logs in as it.

So we have such an account we use for CD in other scenarios, I say its a shared account but in reality we do not share the creds and we do not want to. So while I have access, @fresh-musician-40418 does not, and he is setting up Pulumi.

Is this your current problem? • Limited number of accounts (3, iirc). • 1 needs to be admin (you). • 1 needs to be CI. • You have 15 other infra devs. We have this with one project. It is the ultimate push towards gitops! 🙂

Yup, I think so, more of less.

Our solution was a for dev envs to use local / private state, and only CI to use the Pulumi service. It's not awesome, but it forces excellent practices with things like project and stack naming. And in our case, the problem went away just after we got everything working acceptably, because the company saw how useful Pulumi was and upgraded us.

• 1 Me (Admin in GH and Pulumi) • 1 CI (Admin in GH and Pulumi) • 4-5 Devs

CI doesn't need to be admin...

Alright. All good advice and help. We'll continue and see where we end up. Thanks!